SUSPICIOUS — laxesajuboruvurerefoval.pdf

SUSPICIOUS — laxesajuboruvurerefoval.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 522053bf9ec993f2c7ca508387ffdc849ff43d13c79c19221e56256890cf267c
• SHA-1: 59eaa73b763931f89ca53446363da8547e312360
• MD5: 1551b4e1c1269082ddbd32fdb445114b
• ssdeep: 768:rgGzpDZjQmdRpxEQ6KRQnElibToXare+AHNL/emn94V:UGFNja/WQNToKre+CUmn94V
• TLSH: T11E31AEF31027DD4C39CA9F03AADA1559518AD3886173E6A8598C7B7CC4786FC2F40A62
• Submitted as: laxesajuboruvurerefoval.pdf
• File type: pdf · Size: 41648 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/strik?keyword=biostatistics+course+pdf, http://xixase.kerryrodgers.com/uploads/1/3/0/7/130740572/rurafadinavowowuxot.pdf, http://files.randylauw.com/uploads/1/3/0/8/130814066/tixubilimor-fugaxekilofup.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://gettraff.ru/strik?keyword=biostatistics+course+pdf
• http://xixase.kerryrodgers.com/uploads/1/3/0/7/130740572/rurafadinavowowuxot.pdf
• http://files.randylauw.com/uploads/1/3/0/8/130814066/tixubilimor-fugaxekilofup.pdf
• http://files.visualizingthebrain.org/uploads/1/3/0/7/130738822/fubogovore_laduz.pdf
• https://cdn.shopify.com/s/files/1/0482/7643/9198/files/geometry_area_apothem_worksheet_answer_key.pdf
• https://cdn.shopify.com/s/files/1/0431/1462/7223/files/black_diamond_storm_headlamp_manual.pdf
• https://site-1036791.mozfiles.com/files/1036791/zebuzekiwoga.pdf
• https://site-1037906.mozfiles.com/files/1037906/16331151543.pdf
• https://site-1036932.mozfiles.com/files/1036932/41224569155.pdf
• https://site-1036939.mozfiles.com/files/1036939/21874726496.pdf
• https://site-1036911.mozfiles.com/files/1036911/nojasanibilapox.pdf
• http://tavoxe.theriverinn.net/uploads/1/3/1/6/131637306/9231b8584.pdf
• http://files.campsidneydew.org/uploads/1/3/0/9/130969428/xumaturosigatajusibe.pdf
• http://files.manassehart.com/uploads/1/3/1/4/131409244/dubedusamowu-verikowiluzatol-silajijani-zowurusaxonigam.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• xixase.kerryrodgers.com
• files.randylauw.com
• files.visualizingthebrain.org
• cdn.shopify.com
• site-1036791.mozfiles.com
• site-1037906.mozfiles.com
• site-1036932.mozfiles.com
• site-1036939.mozfiles.com
• site-1036911.mozfiles.com
• tavoxe.theriverinn.net
• files.campsidneydew.org
• files.manassehart.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report